{"record":{"id":"ca72f03baf9405e9","repo":"spring-projects/spring-security","slug":"unable-to-initialize-due-to-invalid-decryption-par","errorCode":null,"errorMessage":"Unable to initialize due to invalid decryption parameter spec","messagePattern":"Unable to initialize due to invalid decryption parameter spec","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java","lineNumber":128,"sourceCode":"\n\t/**\n\t * Initializes the Cipher for use.\n\t */\n\tstatic void initCipher(Cipher cipher, int mode, SecretKey secretKey,\n\t\t\t@Nullable AlgorithmParameterSpec parameterSpec) {\n\t\ttry {\n\t\t\tif (parameterSpec != null) {\n\t\t\t\tcipher.init(mode, secretKey, parameterSpec);\n\t\t\t}\n\t\t\telse {\n\t\t\t\tcipher.init(mode, secretKey);\n\t\t\t}\n\t\t}\n\t\tcatch (InvalidKeyException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Unable to initialize due to invalid secret key\", ex);\n\t\t}\n\t\tcatch (InvalidAlgorithmParameterException ex) {\n\t\t\tthrow new IllegalStateException(\"Unable to initialize due to invalid decryption parameter spec\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * Invokes the Cipher to perform encryption or decryption (depending on the\n\t * initialized mode).\n\t */\n\tstatic byte[] doFinal(Cipher cipher, byte[] input) {\n\t\ttry {\n\t\t\treturn cipher.doFinal(input);\n\t\t}\n\t\tcatch (IllegalBlockSizeException ex) {\n\t\t\tthrow new IllegalStateException(\"Unable to invoke Cipher due to illegal block size\", ex);\n\t\t}\n\t\tcatch (BadPaddingException ex) {\n\t\t\tthrow new IllegalStateException(\"Unable to invoke Cipher due to bad padding\", ex);\n\t\t}\n\t}","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java#L110-L146","documentation":"Thrown by CipherUtils.initCipher when cipher.init(mode, key, params) throws InvalidAlgorithmParameterException. The AlgorithmParameterSpec (typically the IV/GCM parameters) provided for decryption is invalid for the cipher: null when required, wrong class, or wrong length (e.g. a non-16-byte IV for AES-CBC).","triggerScenarios":"Decrypting with an IvParameterSpec built from an IV that was never stored or was corrupted; passing a null parameter spec to a mode that requires one; using a GCMParameterSpec with wrong tag length; reusing encryptor state such that the decrypt path receives an invalid spec.","commonSituations":"IV not persisted alongside ciphertext (schema change dropped the IV column); IV truncated during transport/encoding; migration between CBC and GCM where the parameter spec class changed; provider quirks on FIPS JVMs.","solutions":["Store and retrieve the full IV/nonce with the ciphertext and pass the exact bytes when constructing the spec.","Use the correct spec class and lengths: IvParameterSpec with a 16-byte IV for AES-CBC; GCMParameterSpec(tagLenBits, nonce) for GCM.","Verify the parameter spec survives your serialization (Base64 the IV rather than raw string round-trips).","Check you're not passing null params to init when the mode requires them."],"exampleFix":"// before\nbyte[] iv = storedValue.getBytes(); // truncated/corrupted\nCipher cipher = CipherUtils.initCipher(cipher, Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));\n// after\nbyte[] iv = Base64.getDecoder().decode(storedIvBase64); // full 16 bytes as produced at encryption time\nCipher cipher = CipherUtils.initCipher(cipher, Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));","handlingStrategy":"validation","validationCode":"if (iv == null || iv.length != 16) {\n    throw new IllegalArgumentException(\"CBC IV must be exactly 16 bytes, got \" + (iv == null ? \"null\" : iv.length));\n}","typeGuard":null,"tryCatchPattern":"try {\n    CipherUtils.initCipher(cipher, Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));\n} catch (IllegalStateException ex) {\n    throw new DataCorruptionException(\"Invalid IV for decryption — IV missing or altered\", ex);\n}","preventionTips":["Always persist the IV alongside ciphertext (Base64-encoded, fixed length).","Store IVs in lossless columns (VARBINARY or Base64 TEXT), never padded CHAR fields.","For GCM use GCMParameterSpec with the original nonce and tag length.","Include IV round-trip in integration tests."],"tags":["crypto","iv","algorithm-parameters","decryption","spring-security"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}